Kn1ght

Web Penetration Tester, Security researcher, bug bounty hunter 🐞
Vietnamese 🇻🇳🇻🇳🇻🇳

[Nasreddine Bencherchali @nas_bench]

I have spent some time this past day to investigate NodeJS source code and how a typical process tree from a react/next.js app will look like.

If you are building detections for React2Shell give this a read. as it'll help you identify the right strings to use to filter down FPs and what anomalous look might like.

https://t.co/pSSYRFir6O

[Kn1ght @hrxknight]

@F4tM4n2k Nice bro 😎

[Dluka @4kulD]

🚨XSS Found🚨

1⃣ katana -u "url" -d 5 -ps -pss waybackarchive,commoncrawl,alienvault -kf -jc -fx -ef woff,css,png,svg,jpg,woff2,jpeg,gif,svg thx man @coffinxp7 🥂

2⃣ nuclei -t /string/dast/ -dast -headless

3⃣ Confirm payloads!

[Albert @YZ9YT @yz9yt]

@coffinxp7 Brother, some time ago I made this tool for when you're targeting a large number of subdomains. The idea was to create a fast tool for discovery.

https://t.co/7CEgnOrwuy

#bugbounty #hacking #cybersecurity

[hipotermia @hipotermia]

h1-6102 @Hacker0x01 @salesforce

[Coffin @lostsec_]

After going through all the comments and questions about setting up IDN domains and using Punycode based emails, I finally made a video that covers everything step by step. I’m confident this will help many of you land some serious bounties!
https://t.co/EcGMaLGlbP

[Ben Sadeghipour @NahamSec]

This #NahamCon2025 talk has generated over $50,000 in bounties for @YShahinzadeh and a few other hackers: Puny-Code, 0-Click Account Takeover.

🎥👉🏼https://t.co/BsVhu4Vold

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

🔍 Bug Bounty Web Checklist
Track your web pentesting progress by checking each subcategory.

https://t.co/fuMRx2BwUl

[Muqsit 𝕏 @mqst_]

📋 Detailed Checklist: Android APK Pentesting Checklist

Checklist: https://t.co/QoSljusi0g

#infosec

[Mr_mars_hacker @Mr_mars_hacker]

"Business logic allows any user to be blocked from creating an account"

https://t.co/pn3QLCLcA1

#bugbounty #bugbountytips

[ghostlulz @ghostlulz1337]

API Hacking - Cracking JWT Tokens
https://t.co/jnlggOLHzK

Pre Account Takeover
https://t.co/q8ZHZMVJyx

XSS With Polyglots
https://t.co/U24Xbb3d0W

React JS SourceMaps to XSS
https://t.co/qolAwpZcUf

Bypass AI Powered Wafs
https://t.co/BdMfu0gaQS

#bugbounty #bugbountytips #bugbountytip #infosec #xss #OWASP #redteam #pentest #hackerone #bugcrowd

[Intigriti @intigriti]

Want to master client-side bugs? 😎

Check out this extensive GitHub repository with tens of different resources curated by @zomasec!

🔗 https://t.co/9PULUiwZvp

[Alexandrio @alexbindrei]

Vibe coding? Nah, Hacking with a vibe 🌆🗽

[Gospel @4osp3l]

While learning and practicing website application security and exploitation, also learn to hack APIs effectively.

https://t.co/9lE8GMjdKX

[khan mamun @mamunwhh]

SQL Injection

[Project Sekai CTF @ProjectSEKAIctf]

🎁Monthly Giveaway🎁

Hack The Box 6-month VIP+
- Follow, Like, and Retweet to join!
- Winners will be picked randomly on 5 June.

#hackthebox #giveaway #projectsekaictf

[Clint Gibler @clintgibler]

🔥 𝐀𝐈 𝐑𝐞𝐝 𝐓𝐞𝐚𝐦𝐢𝐧𝐠 𝐏𝐥𝐚𝐲𝐠𝐫𝐨𝐮𝐧𝐝 𝐋𝐚𝐛𝐬 from @Microsoft
12 free labs to up-level your hacking skills from the “AI Red Teaming in Practice” Black Hat training, covering:

- Credential exfiltration
- Extracting a secret from the metaprompt
- Indirect prompt injection
- and more!

Super cool that this was open sourced, huge shout-out to Dr. Amanda Minnich (AIRT), Gary L., Martin Pouliot, and anyone else involved 🙏

🔗 https://t.co/LVNZX4LDFQ

[𝕏 Bug Bounty Writeups 𝕏 @bountywriteups]

https://t.co/irbSntOPYb

[Burp Suite @Burp_Suite]

Want to quickly and easily import BChecks and Bambdas to your library?

👀 Check out Extensibility Helper on the BApp Store!

📄 Pull scripts directly from the PortSwigger community repositories, or provide your own for a custom store experience.

[Yousef @iYousefAlotaibi]

Built a Burp Suite extension to run SQLmap directly from the GUI.

No more saving HTTP requests + jumping to terminal.

Just:
– Mark param with *
– Right-click → Send to SQLmap
– Pick options → Run

Linux-only for now. Windows support coming soon.
Full write-up: https://t.co/TqTfwOdWk3

#BurpSuite #SQLmap #CyberSecurity #BugBounty #RedTeam #infosec